attack.t1567.002 | Detection.FYI

PUA - Rclone Execution

Nov 24, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Read More
Rclone Activity via Proxy

Nov 24, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Read More
PUA - Restic Backup Tool Execution

Oct 24, 2025 · attack.exfiltration attack.t1048 attack.t1567.002 ·
Share on:

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

Read More
Network Connection Initiated To Mega.nz

Jul 30, 2025 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

Read More
Suspicious Dropbox API Usage

Jul 30, 2025 · attack.command-and-control attack.exfiltration attack.t1105 attack.t1567.002 ·
Share on:

Detects an executable that isn't dropbox but communicates with the Dropbox API

Read More
APT40 Dropbox Tool User Agent

Jun 12, 2025 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 detection.emerging-threats ·
Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Read More
DNS Query for Anonfiles.com Domain - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Read More
DNS Query for Anonfiles.com Domain - Sysmon

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Read More
DNS Query To MEGA Hosting Website

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for subdomains related to MEGA sharing website

Read More
DNS Query To MEGA Hosting Website - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries for subdomains related to MEGA sharing website

Read More
DNS Query To Ufile.io

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More
DNS Query To Ufile.io - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More
Rclone Config File Creation

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects Rclone config files being created

Read More